Print Page | Close Window

Denial Attack

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4468
Printed Date: 19 April 2025 at 4:53pm


Topic: Denial Attack
Posted By: Guests
Subject: Denial Attack
Date Posted: 22 October 2004 at 9:24pm

To whom it may concern,

In the last few days, we've been bombarded by what I believed a denial-attack or mass e-mailing campaing. I looked at the number of connections, and it showed over 16000 or (1600) threads from a single IP address.  It slowed our internet connect almost down to a crawl and populating the logs at an alarming rate.  I've block the the IP address from where it came from.  Why isn't that the SpamFilter dropping the connections on it's own?  I had to stop the Spamfilter service manually in order to stop the connects.  Or is it not configured properly on my part?  Thanks.  Also below is just a small sample of the log.

 

 

10/22/04 17:48:43:265 -- (1596) - SPF analysis done: - fail
10/22/04 17:48:43:265 -- (1596) - SPF analysis done: - fail
10/22/04 17:48:43:328 -- (1596) - SPF record found. analyzing: - v=spf1 mx ip4:66.28.139.0/24 ip4:66.98.160.93 ip4:66.98.248.20 ip4:207.246.86.0/25 ip4:208.239.240.102 ip4:208.239.240.73 include:newsletterinc.com include:squabblers.com include:newsletterplanet.com include:nichenewsletters.com -all
10/22/04 17:48:43:437 -- (1596) - SPF record found. analyzing: - v=spf1 mx ip4:66.28.139.0/24 ip4:66.98.160.93 ip4:66.98.248.20 ip4:207.246.86.0/25 ip4:208.239.240.102 ip4:208.239.240.73 include:newsletterinc.com include:squabblers.com include:newsletterplanet.com include:nichenewsletters.com -all
10/22/04 17:48:43:484 -- (1596) - SPF analysis done: - fail
10/22/04 17:48:43:531 -- (1596) - SPF record found. analyzing: - v=spf1 mx ip4:66.28.139.0/24 ip4:66.98.160.93 ip4:66.98.248.20 ip4:207.246.86.0/25 ip4:208.239.240.102 ip4:208.239.240.73 include:newsletterinc.com include:squabblers.com include:newsletterplanet.com include:nichenewsletters.com -all


Replies:
Posted By: Desperado
Date Posted: 23 October 2004 at 11:20am

Can you post what version of SpamFilter you are usinging?

Dan S.

Posted By: LogSat
Date Posted: 25 October 2004 at 12:55am
Vinh,

As Dan S. already asked, I'll have to do the same. We'll need to know what version of SpamFilter you're using to see if you are experiencing the effects of a bug fixed by the follwowing build:

// New to VersionNumber = '2.1.1.372'; {TODO -cFix : SPF - fixed issue with logfile becoming huge due to loops in SPF include directive}

Roberto F. LogSat Software

Posted By: Guests
Date Posted: 25 October 2004 at 1:00am

Hey Dan/Robert, I've been meaning to get back to you guys.  I am currently testing version 2.1.1.367.  Is version 2.1.1.372 available for download?  Thanks.

 

V

Posted By: LogSat
Date Posted: 26 October 2004 at 11:17pm
Vinh,

For registered users, the latest build available is 2.1.1.385. The latest free version is 2.1.1.367.

Roberto F. LogSat Software


Print Page | Close Window